Archive
24 January 2013
Vulnerabilities first published on this day (UTC), newest first.
44 results · Feed
-
Unscored —
content/renderer/media/webrtc_audio_renderer.cc in Google Chrome before 24.0.1312.56 on Mac OS X does not use an approp…
-
Unscored —
Array index error in the content-blocking functionality in Google Chrome before 24.0.1312.56 allows remote attackers to…
-
Unscored —
Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service …
-
Unscored —
Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impac…
-
Unscored —
Google Chrome before 24.0.1312.56 does not properly handle %00 characters in pathnames, which has unspecified impact an…
-
Unscored —
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 b…
-
Unscored —
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2…
-
Unscored —
The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote a…
-
Unscored —
The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software …
-
Medium 5.0CVE-2012-6441 EPSS 57%
Rockwell Automation ControlLogix PLC Information Exposure
An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confident…
-
High 7.5CVE-2012-6438 EPSS 36%
Rockwell Automation ControlLogix PLC Improper Input Validation
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful ex…
-
Unscored —
ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary fi…
-
High 8.5CVE-2012-6439 EPSS 23%
Rockwell Automation ControlLogix PLC Improper Access Control
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that changes the product’s configuration and network parameters, a DoS condition can occur. This…
-
High 7.5CVE-2012-6435 EPSS 43%
Rockwell Automation ControlLogix PLC Improper Access Control
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This si…
-
Critical 9.8CVE-2012-6437 EPSS 11%
Rockwell Automation ControlLogix PLC Improper Authentication
The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause los…
-
High 7.5CVE-2012-6442 EPSS 35%
Rockwell Automation ControlLogix PLC Improper Access Control
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the product to reset, a DoS can occur. This situation could cause loss of availab…
-
High 7.5CVE-2012-6436 EPSS 35%
Rockwell Automation ControlLogix PLC Improper Input Validation
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash. Successful ex…
-
Medium 4.8
Rockwell Automation ControlLogix PLC Improper Input Validation
The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration a…
-
Unscored —
FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and cr…
-
Unscored —
The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of servic…
-
Unscored —
The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of servic…
-
Unscored —
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress …
-
Unscored —CVE-2012-1922 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the aut…
-
Unscored —
Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL …
-
Unscored —CVE-2012-6510 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arb…
-
Unscored —CVE-2012-6508 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hij…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the nBill (com_nbill) component 2.3.2 for Joomla! allows remote attackers t…
-
Unscored —
eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid cour…
-
Unscored —CVE-2012-6520 Public exploit
Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbi…
-
Unscored —
Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors.
-
Unscored —
Cross-site scripting (XSS) vulnerability in apps/admin/handlers/versions.php in Elefant CMS 1.2.0 allows remote attacke…
-
Unscored —CVE-2012-6505 Public exploit
Cross-site scripting (XSS) vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remo…
-
Unscored —CVE-2012-6518 Public exploit
Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authent…
-
Unscored —
The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vector…
-
Unscored —CVE-2012-6517 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web scrip…
-
Unscored —CVE-2012-6504 Public exploit
SQL injection vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers …
-
Unscored —CVE-2012-6519 Public exploit
SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL c…
-
Unscored —CVE-2012-6516 Public exploit
SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via t…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordP…
-
Unscored —CVE-2012-6513 Public exploit
Cross-site scripting (XSS) vulnerability in index.php/Admin_Preferences in gpEasy CMS 2.3.3 allows remote attackers to …